Stitchflow
Datadog logo

Datadog SCIM guide

Native SCIM

How to automate Datadog user provisioning, and what it actually costs

Native SCIM requires Infrastructure Pro or Enterprise plan

Summary and recommendation

Datadog supports native SCIM 2.0 provisioning, but only for Infrastructure Pro ($15-$18/host/month) or Enterprise ($23-$27/host/month) plans. Teams on the free tier or basic plans can't access automated provisioning at all. Additionally, Datadog's SCIM has a critical limitation: team provisioning via Microsoft Entra is completely broken due to a Microsoft security freeze that has blocked third-party app updates since late 2024.

This creates a significant gap for DevOps teams using Entra as their identity provider. While you can provision users automatically, team assignments—which control access to specific dashboards, alerts, and monitoring data—must be managed manually. For fast-growing engineering teams who need immediate access to production monitoring, this defeats the purpose of automation and creates security risks when engineers don't get proper access controls.

The pricing barrier compounds the problem. Moving from Datadog's free tier to Pro just for SCIM access can cost $15-$18 per monitored host per month. For a team monitoring 50 hosts, that's $9,000-$10,800/year in additional licensing costs primarily to unlock provisioning features.

The strategic alternative

Stitchflow provides SCIM-level provisioning through resilient browser automation for Datadog without the plan upgrade requirement. Works with any Datadog tier and any IdP, including full team provisioning support for Entra environments. Flat pricing under $5K/year regardless of your infrastructure size.

Quick SCIM facts

SCIM available?Yes
SCIM tier requiredEnterprise
SSO required first?Yes
SSO available?Yes
SSO protocolSAML 2.0
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaOIN app with full provisioning
Microsoft Entra IDGallery app with SCIM
Google WorkspaceJIT onlySAML SSO with just-in-time provisioning
OneLoginSupported

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Datadog accounts manually. Here's what that costs:

Source: Stitchflow customers using Datadog, normalized to 500 employees:
Orphaned accounts (ex-employees with access)2
Unused licenses2
IT hours spent on manual management/year117 hours
Unused license cost/year$151
IT labor cost/year$7,023
Cost of compliance misses/year$401
Total annual financial impact$7,575

The Datadog pricing problem

Datadog gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Plan Structure (Host-based pricing, annual billing)

PlanPriceSSOSCIM
Free$0 (5 hosts max)
Infrastructure Pro$15/host/month
Infrastructure Enterprise$23/host/month

Note: SCIM supports both user and team provisioning. Additional products like APM ($31-40/host/month), DevSecOps Pro ($22/host/month), and Log Management ($0.10/GB) stack on top of base infrastructure pricing.

What this means in practice

Using current list prices (Free → Infrastructure Pro for SCIM access):

Infrastructure SizeAnnual Cost for Pro Tier
25 hosts$4,500/year
50 hosts$9,000/year
100 hosts$18,000/year
200 hosts$36,000/year

Calculation: $15 × hosts × 12 months (before any additional product costs)

Additional constraints

Host-based pricing model
Costs scale with infrastructure size, not user count, making SCIM expensive for large environments.
Entra team provisioning unavailable
Microsoft's security freeze on third-party app updates has disabled team provisioning via Entra ID, forcing manual team management or alternative solutions.
SAML JIT conflicts
Datadog strongly recommends disabling SAML Just-in-Time provisioning when using SCIM to avoid user state discrepancies.
Service account dependency
SCIM setup requires creating dedicated service account application keys, adding another security surface to manage.

Summary of challenges

  • Datadog supports SCIM but only at Enterprise tier (custom pricing)
  • Google Workspace users get JIT provisioning only, not full SCIM
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What the upgrade actually includes

Datadog doesn't sell SCIM separately. It's bundled into Infrastructure Pro or Enterprise plans starting at $15-23/host/month:

SCIM 2.0 automated provisioning (users and teams)
SAML single sign-on (SSO)
Enhanced monitoring capabilities
Advanced alerting and dashboards
Log management and APM features
Custom metrics and integrations
Priority support tiers
Compliance reporting tools

The challenge: you're paying for infrastructure monitoring capacity (per host) when you might only need identity management. A 100-person engineering team could easily hit $1,500-2,300/month just for user provisioning access, plus the actual monitoring costs.

Stitchflow Insight

We estimate ~60% of Infrastructure Pro/Enterprise features are monitoring-specific and irrelevant for teams that only need automated user provisioning. You're essentially buying observability platform access to get basic identity automation.

What IT admins are saying

Community sentiment on Datadog's SCIM implementation reveals significant frustration with platform-specific limitations and pricing barriers. Common complaints:

  • Being locked out of SCIM unless on Infrastructure Pro or Enterprise plans
  • Team provisioning completely broken on Microsoft Entra due to security freezes
  • Having to disable SAML JIT provisioning to avoid conflicts with SCIM
  • Enterprise-level complexity for basic identity management needs

Team provisioning via Entra SCIM is unavailable due to Microsoft freeze - we're stuck managing teams manually or using workarounds like Terraform.

DevOps Forum

You have to disable JIT when using SCIM to avoid discrepancies. So much for seamless integration.

Reddit r/devops

The recurring theme

Datadog's SCIM feels like an afterthought with platform-specific breakdowns and configuration conflicts that force admins into manual workarounds for basic provisioning tasks.

The decision

Your SituationRecommendation
On Infrastructure Standard, need SCIMUse Stitchflow: avoid the $15-23/host/month Pro/Enterprise upgrade
On Infrastructure Pro/Enterprise alreadyUse native SCIM: you're paying for it and it works well
Using Entra ID, need team provisioningUse Stitchflow: Entra team sync is broken due to Microsoft freeze
Fast-growing DevOps team, need rapid onboardingUse Stitchflow: ensures engineers get monitoring access immediately
Small, stable engineering teamManual may work: but observability data sensitivity makes SCIM worthwhile

The bottom line

Datadog's SCIM requires Infrastructure Pro or Enterprise plans ($15-23/host/month), which can add $18K-$30K+ annually for mid-sized teams. For organizations on Standard plans or dealing with Entra's broken team provisioning, Stitchflow delivers full automation at <$5K/year flat pricing.

Automate Datadog without the tier upgrade

Stitchflow delivers SCIM-level provisioning through resilient browser automation, backed by 24/7 human in the loop for Datadog at <$5K/year, flat, regardless of team size.

Works alongside or instead of native SCIM
Syncs with your existing IdP (Okta, Entra ID, Google Workspace)
Automates onboarding and offboarding
SOC 2 Type II certified
24/7 human-in-the-loop monitoring
Book a Demo

Technical specifications

SCIM Version

2.0

Supported Operations

Create, Update, Deactivate, Groups

Supported Attributes

Not specified

Plan requirement

Enterprise

Prerequisites

SSO must be configured first

Key limitations

  • SCIM only in Infrastructure Pro or Enterprise plans
  • Strongly recommend disabling SAML JIT when using SCIM
  • Team provisioning via Entra SCIM unavailable due to Microsoft freeze (late 2024 security incident)
  • Service account application key recommended for SCIM

Configuration for Okta

Integration type

Okta Integration Network (OIN) app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Okta Admin Console → Applications → Datadog → Provisioning

Required credentials

SCIM endpoint URL and bearer token (generated in app admin console).

Configuration steps

Enable Create Users, Update User Attributes, and Deactivate Users.

Provisioning trigger

Okta provisions based on app assignments (users or groups).

SCIM 2.0 for user and team (Managed Teams) provisioning. Recommend service account application key. Team sync via push groups with exact name matching. Aquera connector also available.

Native SCIM is available on Enterprise. Use Stitchflow if you need provisioning without the tier upgrade.

Configuration for Entra ID

Integration type

Microsoft Entra Gallery app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Entra admin center → Enterprise applications → Datadog → Provisioning

Required credentials

Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).

Configuration steps

Set Provisioning Mode = Automatic, configure SCIM connection.

Provisioning trigger

Entra provisions based on user/group assignments to the enterprise app.

Sync behavior

Entra provisioning runs on a scheduled cycle (typically every 40 minutes).

SCIM 2.0 for user provisioning. Team provisioning unavailable due to Microsoft freeze on third-party app updates (late 2024 security incident). Use SAML mapping or Terraform for teams.

Native SCIM is available on Enterprise. Use Stitchflow if you need provisioning without the tier upgrade.

Unlock SCIM for
Datadog

Datadog gates automation behind Infrastructure Pro or Enterprise plan. Stitchflow delivers the same SCIM outcomes for a flat fee.

See how it works
Admin Console
Directory
Applications
Datadog logo
Datadog
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

ChatGPT (OpenAI) logo

ChatGPT (OpenAI)

SCIM Tax

AI / LLM Tools

SCIM Tax+200%
Manual Cost$7,705/yr

ChatGPT Enterprise supports native SCIM 2.0 for automated user provisioning, but OpenAI restricts this capability to their highest-tier Enterprise plan with custom pricing (estimated ~$60/seat for 70+ users). The Business plan includes SSO but deliberately excludes SCIM, forcing IT teams into manual user management despite paying $25-30/user/month. This creates a significant pricing cliff: teams must jump from Business to Enterprise—often doubling their spend—just to automate basic user lifecycle operations. This gap between SSO and SCIM creates operational friction for IT teams managing AI tool adoption. While employees can authenticate through your identity provider on the Business plan, you still need to manually provision accounts, manage group memberships, and handle offboarding. For organizations rapidly scaling ChatGPT usage across departments, this manual overhead becomes a bottleneck. The 40-minute sync delay on Azure Entra ID compounds these challenges, making real-time access management impossible even on Enterprise.

View full guide
Freshdesk logo

Freshdesk

SCIM Tax

Customer Support

SCIM Tax+427%
Manual Cost$7,190/yr

Freshdesk supports SCIM provisioning, but only on the Enterprise plan at $79/agent/month. This creates a significant cost barrier for smaller support teams who need automated provisioning but can't justify nearly $1,000/year per agent just to access SCIM. The provisioning system distinguishes between agents (who handle tickets) and contacts (end users), requiring careful configuration to ensure the right people get the right access levels. Role mapping can also require additional setup work to properly assign support agents to appropriate permission groups. For customer support teams, this pricing gate is particularly problematic because support agents often have high turnover rates and need immediate access to handle incoming tickets. Manual provisioning delays mean either security gaps (shared accounts) or customer service delays (agents waiting for access). The Enterprise plan requirement forces smaller teams to either accept manual processes or overpay for features they may not need.

View full guide
Linear logo

Linear

SCIM Tax
SCIM StatusIncluded
Manual Cost$8,330/yr

Linear supports SCIM 2.0 for automated user provisioning, but only on its Enterprise plan with custom pricing (typically $192-240/user/year). The company requires SAML SSO to be enabled before SCIM can be configured, meaning you can't use automated provisioning without also implementing single sign-on. For teams currently on Business ($9.60/user/month annually), upgrading to Enterprise represents a 20x price increase just to unlock basic provisioning automation. This creates a significant gap for growing teams that need automated user lifecycle management but aren't ready for enterprise-level pricing. While Linear offers JIT provisioning through SAML, this only creates accounts when users first log in—it doesn't handle deprovisioning when employees leave or role changes that require immediate access removal. For compliance-focused organizations, waiting for users to self-provision on first login isn't acceptable.

View full guide